Just wondering if anyone here knows why a default install of CentOS has this line:
In /etc/sysconfig/iptables

I'm not sure why it opens this up, and Google reveals little other than it is 'multicast DNS' (plus a ton of conspiracy theories).

I'm guessing it's safe to comment this out?

Just expanding on that, I'm not sure default rules like this:

Are ideal either especially when it has no web server installed, has a live sendmail installed by default (not tested for open relay yet), has no printer, let alone the need to offer CUPS to other clients, and as for 60 and 51 - I'm at a loss to understand the need to open those by default.

22 is the default port for ssh (sshd) which is also used by scp/sftp. If you want access to the system via ssh (e.g. from another server or using something like PuTTY on Windows) scp or sftp you either need to have this open or change the port used sshd to something else and open that port (then close 22).

25 is for telnet and shouldn't be open by default in my opinion.

However, it doesn't matter if a port is "open" unless you're LISTENing on that port. Therefore the first thing you ought to check is whether the port is in fact LISTENing.

Doing "lsof -i :5353" shows me that it is avahi-daemon that is LISTENing on that port on my CentOS box. You'd want to understand what this daemon does before you decided to block it.

Doing lsof -i :<port> for the other ports you questioned should tell you what if anything is happening on those ports. Rather than simply blocking the ports by disabling in iptables you might want to disable whatever is LISTENing (e.g. cupsd for cups, xinetd service for telnetd maybe - see /etc/xinetd.d files). Disabling the ports in iptables if not necessary is a good idea but if nothing is LISTENing it doesn't matter if you haven't blocked them as no connection can be made to a port that isn't LISTENing from outside to inside your system.

port 25 is SMTP
port 23 is telnet

Kind regards

Hi,

since you're asking about port 5353 you may find answers here or here.

Good luck

I'd already looked through those links, and they are most MacEsque in tone.

It basically, for a desktop machine with no services running on it, looks like a bum set of rules to have with a default install, but I guess that comes down to Cent from the upstream.

I'll just kill them, no problem, but I wondered why they were there by default, particularly 5353.

D'oh - You're right.

Did you read my post? I told you it is for avahi-daemon.

1 members found this post helpful.

I'll be totally honest, when I read the line:

I skipped on because I knew it was not accurate. It was not a deliberate act or disrespect - it's just a subliminal thing, which is why I'm putting my hands up and saying 'no, I didn't read all of it' and trying to say why without being rude or smug, just honest.

avahi-daemon
Yuk - that's sounds a bit uPNP-ish-esque to me and something I'd definitely NOT want alive and kicking by default, or open. I can't think of any reasons why I would ever want to use this?

Thank you for solving the mystery and my apologies for not reading your post properly - I have told myself off and I am honestly grateful for the answer.